Joomla-cms: Error after upgrade to 3.6.1

[sarsami]

Steps to reproduce the issue

Update com_joomlaupdate

Upgrade from joomle 3.6.0 to 3.6.1 using built in Joomla update extention.

Check Extention - Manga- Database all well upgrade finished without problems

Log out.

Try to log back (via back-end).

Get error: Failed to start the session: already started by PHP ($_SESSION is set).

Can to do anything but log out no access to other options.

Happens on 6 website that have been updated all with different configurations.

Expected result

Actual result

System information (as much as possible)

Additional comments

[zero-24]

please let us know which extensoins you have installed?

[ggppdk]

Also your system information is missing
Most important
PHP / Mysql versions
and Server type

[sarsami]

MySQL 5.5.50-cll
PHP 5.3.29

As far as extensions are concerned six websites in question have multitude of difference extensions. The only common denominator (extensions that are on all 6) are ACL Manager and SecurityCheck Pro.

---

_{This comment was created with the J!Tracker Application at issues.joomla.org/joomla-cms/11428.}

[sarsami]

server is Apache

---

_{This comment was created with the J!Tracker Application at issues.joomla.org/joomla-cms/11428.}

[zero-24]

please disable that both extensions. (e.g. via database or folder rename)

[jeckodevelopment]

PHP 5.3 ??????

[sarsami]

Done still same error.

---

_{This comment was created with the J!Tracker Application at issues.joomla.org/joomla-cms/11428.}

[sarsami]

Yes planned upgrade to PHP7 scheduled for September, but I have not read anywhere yet that 3.6. version was not compatible with PHP 5.3.29

---

_{This comment was created with the J!Tracker Application at issues.joomla.org/joomla-cms/11428.}

[sarsami]

If that is the case I would never attempt updated to 3.6.1

---

_{This comment was created with the J!Tracker Application at issues.joomla.org/joomla-cms/11428.}

[mbabker]

5.3's only an issue because it's so old. Not an issue here unless someplace introduced PHP 5.4+ specific code incorrectly.

[sarsami]

Well have not had any issues on any of the websites so far until 3.6.1 upgrade. Even now front of the websites is working perfectly well. All components, templates etc.. perform completely well. The only issue is that I can not log in to the back-end and currently can not make any changes to the website. So I do not thing it is extensions issue.

---

_{This comment was created with the J!Tracker Application at issues.joomla.org/joomla-cms/11428.}

[ggppdk]

The other user that reported same problem, also has PHP 5.3.29
https://github.com/joomla/joomla-cms/issues/11429

[jeckodevelopment]

BTW, both @sarsami and @Tuscany58 have PHP 5.2.29

[jeckodevelopment]

@ggppdk you're too fast!

[mbabker]

That error is thrown here and it's code that's PHP version aware. So that shouldn't be an issue. That said, what's causing the session to be created before this point?

[sarsami]

Both extensions disabled. Still same error.

---

_{This comment was created with the J!Tracker Application at issues.joomla.org/joomla-cms/11428.}

[jeckodevelopment]

I can confirm that i followed these steps on PHP 5.5.x and all is fine:

• Updated Joomla! Update Component
• Updated Joomla! CMS through the Joomla! Update Component.
• Happy :)

[jeckodevelopment]

it could be useful to have the full list of extensions installed. Including plugins.
And please let us know if they are websites updated from a previous version (or migrated) or clean installations.

[sarsami]

They are clean installs on joomla 3.5 upgraded then to 3.6 and now to 3.6.1.

---

_{This comment was created with the J!Tracker Application at issues.joomla.org/joomla-cms/11428.}

[jeckodevelopment]

How did you complete the upgrade from 3.5 to 3.6 ?
Automatic update through the Joomla! Update Component or manually?

[sarsami]

I can not upgrade to 5.5 at the moment so I am sorry but the fact it is working on 5.5 is not helping. If new 3.6.1 is not working with 5.3.29 it needs to be stated.

---

_{This comment was created with the J!Tracker Application at issues.joomla.org/joomla-cms/11428.}

[sarsami]

Automatic update through Joomla. all updates were done via Automatic Update.

---

_{This comment was created with the J!Tracker Application at issues.joomla.org/joomla-cms/11428.}

[mbabker]

Except there is no proof that Joomla 3.6.1 is NOT working correctly on a PHP 5.3 build. All there is right now is the error message which is triggered on PHP 5.3 builds due to something (core, extension, anything) having created a session reference before it's expected. It could be a PHP version related issue, it could be a core change, it could be an extension, in either case it's too soon to point fingers and blame one thing.

[jeckodevelopment]

@sarsami i know. I'm just trying to understand where is the issue. Btw, PHP 5.3.x is unsupported and outdated software.

[wilsonge]

https://github.com/joomla/joomla-cms/issues/11429 seems like a similar issue except it's on PHP 5.6 - so seems unrelated to PHP version :/

[ggppdk]

@wilsonge

No it is MySql 5.6
you need some rest ...

PHP version is 5.3.29

and also

They are clean installs on joomla 3.5 upgraded then to 3.6 and now to 3.6.1.

Can any confirm that a clean installation works on PHP 5.3.29 ?

[mbabker]

I'm gonna lay money at this point the problem is in one of the security hardening patches merged for 3.6.1 that causes the session ID to be regenerated after a login (you no longer have a persistent session ID between when you're an unauthenticated guest and logging into the site).

[jeckodevelopment]

Can any confirm that a clean installation works on PHP 5.3.29 ?

It could be an interesting test.

[wilsonge]

Trying to install on PHP 5.3

[jeckodevelopment]

@Tuscany58 try to disable also com_datasafe_pro

[sarsami]

I have website that has no additional plugins or extensions. Same MSQL ver same PHP version. And same problem. This was 3.5 Joomla install and yes I have installed 3.5 clean without issues on 5.3.29PHP multiple times. This site was updated to 3.6 and now 3.6.1 automatically. Same error. Upgrade goes perfectly well. No issues but when you try to log in again fails with same error. So it is not extension or plugin (unless it is Joomla core plugin we are talking).

---

_{This comment was created with the J!Tracker Application at issues.joomla.org/joomla-cms/11428.}

[jeckodevelopment]

So it seems to be related to PHP 5.3. Let's wait for the test on clean installation by George

[Tuscany58]

I renamed component directory of com_datasafepro - login still not possible (backend)

[wilsonge]

I have reproduced this issue on a fresh site with PHP 5.3.29 - confirmed that it also doesn't happen on 5.4

[jeckodevelopment]

So Joomla 3.6.1 is not compatible with PHP 5.3.29

[mbabker]

So Joomla 3.6.1 is not compatible with PHP 5.3.29

It is but isn't. It's not that a PHP 5.3 incompatible change has been introduced, but as I hinted at above, a security hardening patch basically exposed that JSession::fork() does NOT work correctly against PHP 5.3. Or maybe it does but the check that causes the error to be raised is inefficient (which would be rather interesting, that was derived from Symfony's HttpFoundation component and their session API).

[Tuscany58]

I asked the guys from Siteground if they can upgrade my account to a hiogher PHP version. (no answer yet)

[sarsami]

There is quite a list of this type of error "Failed to start the session: already started by PHP ($_SESSION is set)" connected to Symfony2 out there.

---

_{This comment was created with the J!Tracker Application at issues.joomla.org/joomla-cms/11428.}

[jeckodevelopment]

@mbabker do you think that if they update to PHP 5.4, or newer, the issue will be resolved?

[sarsami]

Also where does this leave us? is there a chance of a patch for this issue or not?

---

_{This comment was created with the J!Tracker Application at issues.joomla.org/joomla-cms/11428.}

[ggppdk]

With more Joomla developers posing PHP 5.4 requirement for new versions of their extensions (myself for my next version too)

Joomla at PHP 5.3 does not get enough testing

[sarsami]

I get all that but in effect as I can not do upgrade for another month or two is there a chance of a patch. Also I think it would be prudent to put that 3.6.1 is not to be used for users with PHP 5.3.29

---

_{This comment was created with the J!Tracker Application at issues.joomla.org/joomla-cms/11428.}

[mbabker]

I updated .org sites on PHP 5.6 and my own site on SiteGround with PHP 7 and have zero issues with it.

In the long run, basically https://github.com/joomla/joomla-cms/blob/3.6.1/libraries/joomla/session/handler/native.php#L143 needs to look closer to https://github.com/symfony/http-foundation/blob/v2.8.9/Session/Storage/NativeSessionStorage.php#L192 and NOT call the doSessionStart method (and inherently bypass the check that's throwing the error because it's not 100% appropriate to that context). Essentially we just need to check for an active session first, not whether it's been fully started, as it'd be expected the session is started before it'd be regenerated.

[Tuscany58]

OK, I can change PHP version through cpanel. which version do You recommend me to choose?
5.4
5.5
5.6
7.0

[mbabker]

PHP 5.6 minimum. Every older version is no longer supported by php. Otherwise, a minimum of 5.4 should at least get you up and running again.

[Tuscany58]

confirmed. switching to version 5.6 resolved the issue

[sarsami]

I will start long winding road of restoring back-up as I currently can not update PHP. It does not look like there is solution for the problem nor that there will be one. I understand that 5.3.29 is old but taking into the account that PHP 5.3 is still used in 20.2% installations I suggest flagging that Joomla 3.6.1 upgrade requires 5.4+. It would allow us all a little bit more sleep when upgrades happen.

---

_{This comment was created with the J!Tracker Application at issues.joomla.org/joomla-cms/11428.}

[wilsonge]

comment line 217 and 225-236 of https://github.com/joomla/joomla-cms/blob/3.6.1/plugins/user/joomla/joomla.php

as a very temporary measure. I'm looking into the long term fix

[mbabker]

... except it doesn't REQUIRE PHP 5.4+. There is a bug in a core API that only affects PHP 5.3. That's a major difference. So long as you don't have anything that requires authentication on the site, you're fine. Ya, I know, that seems bass ackwards considering you have to be able to log in to manage your site, but that's really where the issue lies.

[wilsonge]

Please test this patch https://github.com/joomla/joomla-cms/pull/11430

[sarsami]

Thank you @wilsonge that worked. i can log in the the back end now.

---

_{This comment was created with the J!Tracker Application at issues.joomla.org/joomla-cms/11428.}

[Tuscany58]

Guys, let me say THANK YOU to You all. Though it is now 4am here in Austria Your support will give me some rest of sleep.
I am not a coder and not a system administrator; without You it would be hard for me (if ever possible) to solve such an issue.
Nevertheless, it would be very helpful to inform that one needs a minimum version of PHP before updating - but I guess nobody knew this before.
Anyway: THANK YOU!!!

[wilsonge]

@sarsami sorry did you comment out the lines or test the patch? If the patch can you mark that in the pull request please?

[sarsami]

I commented out lines and it worked. I am testing patch now.

---

_{This comment was created with the J!Tracker Application at issues.joomla.org/joomla-cms/11428.}

[sarsami]

YES!!! Patch works. Thanks soo much @wilsonge.

---

_{This comment was created with the J!Tracker Application at issues.joomla.org/joomla-cms/11428.}

[wilsonge]

Thank you! I'm really sorry things went so wrong with the release today for you :(

[Tuscany58]

All good wilsonge. It's the result that counts; and now I know where to go if issues happen (hopefully not) ;-)

[sarsami]

Nothing to apologize. Thanks soo much and by the time Joomla is updated again I will be on PHP 7 and will not have to trouble you with old version compatibility.

---

_{This comment was created with the J!Tracker Application at issues.joomla.org/joomla-cms/11428.}